CVE-2024-50919

CRITICAL

Jpress < 5.1.1 - Unauthenticated Arbitrary File Upload and Remote Code Execution via JSP File Construction

Title source: llm
STIX 2.1

Description

Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0114
EPSS Percentile 62.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
jpress/jpress < 5.1.1
Published Nov 18, 2024
Tracked Since Feb 18, 2026